Issue #26657: Fix SimpleHTTPServer Windows directory traversal vulnerability

Based on patch by Philipp Hagemeister.  This fixes a regression caused by
revision 6b314f5c9404.

diff --git a/Lib/SimpleHTTPServer.py b/Lib/SimpleHTTPServer.py
index 783d0ac270e88bd960886079212464aacaa9ca27..c140a273fbe7090f1d6e251d56abc8c6b5cb8a99 100644 (file)
--- a/Lib/SimpleHTTPServer.py
+++ b/Lib/SimpleHTTPServer.py
@@ -167,9 +167,9 @@ class SimpleHTTPRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
         words = filter(None, words)
         path = os.getcwd()
         for word in words:
-            drive, word = os.path.splitdrive(word)
-            head, word = os.path.split(word)
-            if word in (os.curdir, os.pardir): continue
+            if os.path.dirname(word) or word in (os.curdir, os.pardir):
+                # Ignore components that are not a simple file/directory name
+                continue
             path = os.path.join(path, word)
         if trailing_slash:
             path += '/'

diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
index 8dab627e76b9be1adff963d3149325cf6ab3e455..672c187a42836d23ced26ffe2dd13bc929639e87 100644 (file)
--- a/Lib/test/test_httpservers.py
+++ b/Lib/test/test_httpservers.py
@@ -8,6 +8,7 @@ import os
 import sys
 import re
 import base64
+import ntpath
 import shutil
 import urllib
 import httplib
@@ -604,6 +605,25 @@ class SimpleHTTPRequestHandlerTestCase(unittest.TestCase):
         path = self.handler.translate_path('//filename?foo=bar')
         self.assertEqual(path, self.translated)
 
+    def test_windows_colon(self):
+        import SimpleHTTPServer
+        with test_support.swap_attr(SimpleHTTPServer.os, 'path', ntpath):
+            path = self.handler.translate_path('c:c:c:foo/filename')
+            path = path.replace(ntpath.sep, os.sep)
+            self.assertEqual(path, self.translated)
+
+            path = self.handler.translate_path('\\c:../filename')
+            path = path.replace(ntpath.sep, os.sep)
+            self.assertEqual(path, self.translated)
+
+            path = self.handler.translate_path('c:\\c:..\\foo/filename')
+            path = path.replace(ntpath.sep, os.sep)
+            self.assertEqual(path, self.translated)
+
+            path = self.handler.translate_path('c:c:foo\\c:c:bar/filename')
+            path = path.replace(ntpath.sep, os.sep)
+            self.assertEqual(path, self.translated)
+
 
 def test_main(verbose=None):
     try:

diff --git a/Misc/NEWS b/Misc/NEWS
index f02087f9324f3b36500347226f65af3decc24d3c..3476b0bf4ae08d34402e09f4b1f4a544ff715271 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -77,6 +77,10 @@ Core and Builtins
 Library
 -------
 
+- Issue #26657: Fix directory traversal vulnerability with SimpleHTTPServer
+  on Windows.  This fixes a regression that was introduced in 2.7.7.  Based
+  on patch by Philipp Hagemeister.
+
 - Issue #19377: Add .svg to mimetypes.types_map.
 
 - Issue #13952: Add .csv to mimetypes.types_map.  Patch by Geoff Wilson.